As of 25 May 2018, the EU Regulation on personal data protection – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter the “RODO Regulation”) will come into force. The national data protection legislation will also change, in particular the current Data Protection Act of 29.08.1997 will be repealed and the Data Protection Act of 10 May 2018 will come into force (these provisions are hereinafter collectively referred to as the “RODO Regulations”).
In connection with the implementation of the RODO Regulations, MAYS Family Company sp. z o.o. with its registered office in Krakow, Stanisława Lema Street 24/LU1 (hereinafter referred to as Mays) informs you about the principles of processing your personal data and your rights related to it.
The following rules apply as of 25 May 2018.
I. DESIGNATION OF THE CONTROLLER OF PERSONAL DATA
The Administrator of Personal Data is Mays (hereinafter referred to as the “DO Administrator”). Contact with the DO Administrator is possible via e-mail: email@example.com or in writing to the address: MAYS Family Company sp. z o.o., 31-571 Krakow, Stanisława Lema Street 24/LU1 with the note “Personal Data”.
II. PURPOSE AND SCOPE OF PERSONAL DATA PROCESSING
(1) MAYS Family Company sp. z o.o. processes your personal data:
(a) in order to take steps prior to entering into a contract at the request of the data subject or in order to perform a contract to which the data subject is a party [Article 6(1)(b) of the RODO Regulation],
b) in order to comply with a legal obligation incumbent on the Controller of the DO [Article 6(1)(c) of the RODO Regulation],
c) on the basis of legitimate interests [Article 6(1)(f) of the DPA Regulation] in order to:
I. direct marketing of MAYS Family Company sp. z o.o. own products or services;
II. organising and conducting competitions and other marketing actions,
III. monitoring and improving the quality of the provided services, including monitoring of telephone calls and customer satisfaction survey from the provided services,
IV. risk management and internal control
V. asserting or securing claims,
VI. providing information on proposed amendments to the Agreement, including the Regulations and Price List,
VII. handling complaints and claims concerning the services provided by Mays. 2.
(2) In addition, Mays may, on the basis of a separate consent [Article 6(1)(a) of the RODO Regulation], process data in order to:
(a) analyses of customer preferences and interests or development of the services provided based on automated processing by the DO Administrator. Based on the customer profile created, the DO Administrator may:
I. adapt the services provided to the individual interests of the customer,
II. offer a personalized offer;
b) marketing of own products or services and similar products and services offered by Mays partners,
c) direct marketing of products or services of entities co-operating with Mays, whereas the client’s personal data will not be made available to third parties. 3;
3) The marketing referred to in points b) – c) above may be carried out by Mays via electronic means of communication, i.e. SMS, e-mail, MMS, mobile application on a telephone and via telephone communication.
III. PERIOD OF PROCESSING OF PERSONAL DATA
Your data will be processed for the period necessary for the purposes indicated in pt. II purposes, including:
(a) for the duration of the contract, and thereafter for the period necessary for:
e-sale customer service (e.g. handling complaints)
secure and assert any potential claims to which Mays is entitled
for the performance of a justified legal obligation of the DO Administrator arising from the law, tax and accounting regulations;
b) personal data processed for the purpose of marketing Europcar’s own products or services on the basis of a legitimate legal interest shall be processed until the data subject objects;
c) personal data processed on the basis of a separate consent will be kept until revoked.
IV. RIGHTS OF THE DATA SUBJECT
You have the following rights under the RODO Regulations:
(a) the right of access to the personal data being processed, i.e. the right to obtain confirmation through the Controller DO whether and to what extent personal data are being processed;
b) the right to rectification of data where there is a reasonable suspicion that the data being processed are inaccurate or incomplete;
c) the right to restrict data processing, including: i. the right to withdraw consent granted earlier (withdrawal of consent shall not affect the lawfulness of data processing carried out on the basis of consent before its withdrawal), ii. the data subject has raised an objection to data processing – until it is established whether the raised objection to data processing is justified against the legitimate interest of the DO Administrator
d) the right to erasure of personal data in case: i. the data are no longer necessary for the purposes for which they were collected or otherwise processed, ii. the data subject has raised an objection to the processing of the data, iii. the data subject has withdrawn the consent on which the processing is based and there is no other legal basis for the processing, iv. the data are processed in violation of applicable laws, v. the data must be erased in order to comply with an obligation under the law.
e) the right to data portability through the Controller DO to another controller insofar as the processing is based on a contract concluded with the data subject or on a consent given by the data subject;
f) The right to lodge a complaint with the competent supervisory authority in the event that the processing of personal data by Mays is considered to be in breach of the RODO Regulations;
g) The right to obtain intervention from the Controller of the DO, to express one’s position and to contest a decision based on automated processing.
The rights mentioned in a) – g) above can be exercised by contacting the DO Controller (address given in the introduction, with the note: “Data Protection”).
V. INFORMATION ON RECIPIENTS OF PERSONAL DATA
In connection with the processing of personal data for the purposes set out in point. II, your personal data may be made available to the following recipients or categories of recipients:
(a) Entities involved in the processes necessary for the performance of the contracts concluded with you,
b) Entities supporting Mays in its business processes, including entities processing personal data for the benefit of Mays (so called Mays processors) involved in carrying out our activities, including: agents, advertising agencies, sponsors and other entities involved in selling our services or organising marketing actions;
c) Entities related to Mays within the Mays capital group, in the performance of reporting and reporting obligations;
d) Entities providing telecommunications services;
e) Entities that provide debt collection services and entities that purchase receivables – in case you do not pay our bills or invoices on time;
(f) Providers of banking services, in order to make refunds to you or to provide a direct debit service;
(g) Courier or postal services providers;
(h) Providers of transport services;
(i) Entities printing correspondence and handling correspondence from customers;
j) Economic information bureaus and the BIK in order to obtain information about your debt available from these bureaus;
k) The Polish Bank Association in order to verify whether your identity document has been reported to the System of Restricted Documents;
l) Entities archiving documents;
m) Entities engaged in customer opinion surveys;
n) Entities providing Mays with technical services, including: developing and maintaining IT systems and websites, as well as providing Mays with ICT tools;
o) entities providing Mays with advisory, consulting, audit, financial, accounting and legal services;
p) Law enforcement agencies in case of suspicion of committing a crime in connection with the performance of an agreement concluded with Mays.